Nobody can explain why this user has access to a SharePoint folder

An access ticket lands in the queue at 9:14. I open the SharePoint site, check the folder's Manage access panel, then jump to library settings, site permissions, Microsoft 365 group membership, and guest status. The business owner wants a fast answer, but every click raises the same worry: if I remove the wrong permission, a project team loses access; if I leave it, sensitive content may still be exposed.

By late morning I have a partial win. I can see where inheritance was broken and I have narrowed the access path to a group membership plus an old sharing link. That gives me enough evidence to slow the conversation down instead of guessing.

The hard part is turning the evidence into a safe decision. I need the owner to confirm whether the user should still have access, and I need a ticket note that explains what changed and what did not.

The better day is a repeatable trace: site, library, folder, file, group, guest, link, owner decision. I want to answer the ticket in plain English before I touch permissions, and leave behind a cleaner record for the next admin.